@intentius/chant 0.124.45 → 0.124.48

package/src/graph-effective.ts

@@ -1,4 +1,7 @@
 import type { GraphIR, IRNode } from "./graph-ir";
+import { CapabilityEngine, type Evidence } from "./capabilities/matcher";
+import { buildView, type CapabilityPack, type View } from "./capabilities/view";
+import { resolvePacks, shippedRules } from "./capabilities/catalog";
 
 /**
  * Fold DERIVED reachability facts onto EC2 instance nodes so a single-node query
@@ -21,96 +24,244 @@ import type { GraphIR, IRNode } from "./graph-ir";
  * With these, "instances SSH-reachable from the internet" is one predicate:
  *   `kind:EC2::Instance attr:internetFacing=true attr:effectiveIngress=tcp:22:0.0.0.0/0`
  * — no hand-joined CLI sweep, no over/under-counting.
+ *
+ * Both are capability rules (#4375): `internet-facing`, `in-sg` and
+ * `ingress-of` in `capabilities/aws.paths`, over the lexicon-neutral view, so
+ * one rule serves CloudFormation kinds and Terraform's AWS types (#4362)
+ * alike. What stays here is the attribute surface: which nodes get the facts,
+ * and how a rule's evidence is spelled as `proto:port:cidr` and `...Via`.
  */
-export function enrichEffectiveTopology(ir: GraphIR): GraphIR {
-  const byId = new Map(ir.nodes.map((n) => [n.id, n]));
-  const edges = ir.edges ?? [];
-  const kind = (n?: IRNode): string => n?.kind ?? "";
-  const isKind = (n: IRNode | undefined, suffix: string): boolean =>
-    !!n && (kind(n) === suffix || kind(n).endsWith("::" + suffix));
-  const via = (...names: string[]) => (v: string): boolean => names.includes(v);
-
-  /** Out-neighbours of `id` (edges from → to), optionally filtered by viaAttr. */
-  const out = (id: string, pred?: (v: string) => boolean): IRNode[] =>
-    edges
-      .filter((e) => e.from === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-      .map((e) => byId.get(e.to))
-      .filter((x): x is IRNode => !!x);
-  /** In-neighbours of `id` (edges to ← from), optionally filtered by viaAttr. */
-  const incoming = (id: string, pred?: (v: string) => boolean): IRNode[] =>
-    edges
-      .filter((e) => e.to === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-      .map((e) => byId.get(e.from))
-      .filter((x): x is IRNode => !!x);
-
-  const normalizeIngress = (sg: IRNode): string[] => {
-    const rules = (sg.attrs as Record<string, unknown> | undefined)?.["SecurityGroupIngress"];
-    if (!Array.isArray(rules)) return [];
-    return rules.map((r) => {
-      const rule = r as Record<string, unknown>;
-      const proto = String(rule.IpProtocol ?? "-1");
-      const from = rule.FromPort as number | undefined;
-      const to = rule.ToPort as number | undefined;
-      const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
-      const cidr =
-        (rule.CidrIp as string | undefined) ??
-        (rule.CidrIpv6 as string | undefined) ??
-        (rule.SourceSecurityGroupId ? `sg:${String(rule.SourceSecurityGroupId)}` : "?");
-      return `${proto}:${port}:${cidr}`;
-    });
-  };
-
-  /** Security groups reachable from an instance — direct and via launch template. */
-  const effectiveSgs = (inst: IRNode): IRNode[] => {
-    const direct = out(inst.id, via("SecurityGroupIds", "SecurityGroupId"));
-    const templates = out(inst.id, via("LaunchTemplate", "LaunchTemplateId"));
-    const viaTemplate = templates
-      .flatMap((lt) => out(lt.id, via("LaunchTemplateData", "SecurityGroupIds", "SecurityGroupId")))
-      .filter((n) => isKind(n, "SecurityGroup"));
-    const all = [...direct.filter((n) => isKind(n, "SecurityGroup")), ...viaTemplate];
-    return [...new Map(all.map((s) => [s.id, s])).values()];
-  };
-
-  /** The IGW an instance's subnet routes to (evidence), or undefined. */
-  const internetFacingVia = (inst: IRNode): string | undefined => {
-    for (const subnet of out(inst.id, via("SubnetId")).filter((n) => isKind(n, "Subnet"))) {
-      const assocs = incoming(subnet.id, via("SubnetId")).filter((a) => isKind(a, "SubnetRouteTableAssociation"));
-      const routeTables = assocs.flatMap((a) => out(a.id, via("RouteTableId")).filter((n) => isKind(n, "RouteTable")));
-      for (const rt of routeTables) {
-        const routes = incoming(rt.id, via("RouteTableId")).filter((n) => isKind(n, "Route"));
-        for (const route of routes) {
-          const dest = (route.attrs as Record<string, unknown> | undefined)?.["DestinationCidrBlock"];
-          const igw = out(route.id, via("GatewayId")).find((g) => isKind(g, "InternetGateway"));
-          if (igw && (dest == null || dest === "0.0.0.0/0")) {
-            const id = igw.id.includes("::") ? igw.id.slice(igw.id.lastIndexOf("::") + 2) : igw.id;
-            return `${rt.id.includes("::") ? rt.id.slice(rt.id.lastIndexOf("::") + 2) : rt.id} → ${id}`;
-          }
-        }
-      }
-    }
-    return undefined;
-  };
+export function enrichEffectiveTopology(ir: GraphIR, packs: CapabilityPack[] = []): GraphIR {
+  const view = buildView(ir, resolvePacks(packs));
+  const engine = new CapabilityEngine(view, shippedRules().rules);
+  const facing = engine.set("internet-facing");
+  const groups = engine.relation("in-sg").out;
 
   const nodes = ir.nodes.map((n) => {
-    if (!isKind(n, "Instance")) return n;
-    const effectiveIngress = effectiveSgs(n).flatMap(normalizeIngress);
+    const tf = terraformResourceType(n) === "aws_instance";
+    if (!tf && !isKind(n, "Instance")) return n;
+    const attrs = (n.attrs ?? {}) as Record<string, unknown>;
+    const reached = [...(groups.get(n.id) ?? new Map<string, Evidence>())];
+    const ingress = reached.flatMap(([sg]) => ingressStrings(view, sg));
+    const effectiveIngress = tf ? [...new Set(ingress)] : ingress;
     // A live enrichment may already have set internetFacing (+ its evidence) for
     // a subnet chant doesn't model declaratively (e.g. the account's default
     // VPC). Keep that truth; otherwise derive it from the declared route topology.
-    const attrs = (n.attrs ?? {}) as Record<string, unknown>;
     const liveFacing = attrs["internetFacing"] === true;
-    const declaredVia = internetFacingVia(n);
+    const evidence = facing.get(n.id);
+    const declaredVia = evidence && evidence.hops.length > 0 ? facingVia(view, evidence, tf) : undefined;
     const via = (attrs["internetFacingVia"] as string | undefined) ?? declaredVia;
+    const ingressVia = tf ? reached.map(([sg, ev]) => groupPath(view, ev, sg)).join(", ") : "";
     return {
       ...n,
-      attrs: { ...attrs, effectiveIngress, internetFacing: liveFacing || !!declaredVia, ...(via ? { internetFacingVia: via } : {}) },
+      attrs: {
+        ...attrs,
+        effectiveIngress,
+        internetFacing: liveFacing || !!declaredVia,
+        ...(via ? { internetFacingVia: via } : {}),
+        ...(ingressVia ? { effectiveIngressVia: `security groups ${ingressVia}` } : {}),
+      },
     };
   });
   // Record what this pass computed, so a caller can report the graph's derived surface
   // without hardcoding attribute names. Only kinds actually enriched are listed.
   const enriched = nodes.some((n) => isKind(n, "Instance"));
-  const derivedAttrs = enriched
-    ? { ...(ir.derivedAttrs ?? {}), Instance: ["internetFacing", "effectiveIngress"] }
+  const enrichedTf = nodes.some((n) => terraformResourceType(n) === "aws_instance");
+  const derivedAttrs = enriched || enrichedTf
+    ? {
+        ...(ir.derivedAttrs ?? {}),
+        ...(enriched ? { Instance: ["internetFacing", "effectiveIngress"] } : {}),
+        ...(enrichedTf ? { aws_instance: ["internetFacing", "effectiveIngress"] } : {}),
+      }
     : ir.derivedAttrs;
   return { ...ir, nodes, ...(derivedAttrs ? { derivedAttrs } : {}) };
 }
+
+function isKind(n: IRNode | undefined, suffix: string): boolean {
+  const kind = n?.kind ?? "";
+  return !!n && (kind === suffix || kind.endsWith("::" + suffix));
+}
+
+function bare(id: string): string {
+  return id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+}
+
+/** A node's name in a fold's evidence: a terraform address, or a bare logical id. */
+function display(view: View, id: string): string {
+  const v = view.nodes.get(id);
+  if (v && v.lexicon === "terraform") return id.slice(id.lastIndexOf("/") + 1);
+  return bare(id);
+}
+
+/** The ids an evidence path visits, in walk order. */
+function visited(ev: Evidence, start?: string): string[] {
+  const out: string[] = start ? [start] : [];
+  let at = start;
+  for (const h of ev.hops) {
+    const next = at === undefined ? h.to : h.from === at ? h.to : h.from;
+    if (at === undefined) out.push(h.from === next ? h.to : h.from);
+    out.push(next);
+    at = next;
+  }
+  return out;
+}
+
+/** `internetFacingVia`, as each fold always spelled it. */
+function facingVia(view: View, ev: Evidence, tf: boolean): string | undefined {
+  const ids = visited(ev);
+  const of = (label: string) => ids.find((id) => view.nodes.get(id)?.label === label);
+  const rt = of("RouteTable");
+  const igw = of("InternetGateway");
+  if (!rt || !igw) return undefined;
+  if (!tf) return `${bare(rt)} → ${bare(igw)}`;
+  const subnet = of("Subnet");
+  const route = of("Route");
+  const how = route && view.nodes.get(route)?.attrs.block ? "inline route" : route ? display(view, route) : "route";
+  return `subnet route ${subnet ? display(view, subnet) : "?"} -> ${display(view, rt)} -> ${display(view, igw)} (${how})`;
+}
+
+/** One reached group, as `effectiveIngressVia` names it: the group, or the template it came through. */
+function groupPath(view: View, ev: Evidence, sg: string): string {
+  const lt = visited(ev).find((id) => view.nodes.get(id)?.label === "LaunchTemplate");
+  return lt ? `${display(view, lt)} -> ${display(view, sg)}` : display(view, sg);
+}
+
+const STYLE_ORDER = ["cfn", "tf-inline", "tf-sg-rule", "tf-vpc-rule"];
+
+/** A group's ingress rules as `proto:port:source` strings, inline rules first. */
+function ingressStrings(view: View, sg: string): string[] {
+  const rules = view.edges
+    .filter((e) => e.from === sg && e.name === "ingress")
+    .map((e) => view.nodes.get(e.to)!)
+    .filter((r) => r && r.label === "IngressRule");
+  const order = (r: (typeof rules)[number]) => (r.attrs.block ? -1 : STYLE_ORDER.indexOf(String(r.attrs.style)));
+  return [...rules]
+    .sort((a, b) => order(a) - order(b))
+    .flatMap((r) => {
+      const raw = (r.body ?? {}) as Body;
+      switch (r.attrs.style) {
+        case "tf-inline":
+          return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["security_groups"] });
+        case "tf-sg-rule":
+          return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["source_security_group_id"] });
+        case "tf-vpc-rule":
+          return terraformIngress(raw, { proto: "ip_protocol", cidrs: ["cidr_ipv4", "cidr_ipv6", "prefix_list_id"], groups: ["referenced_security_group_id"] });
+        default:
+          return [cloudFormationIngress(raw)];
+      }
+    });
+}
+
+/** One CloudFormation ingress rule as `proto:port:source`. */
+function cloudFormationIngress(rule: Body): string {
+  const proto = String(rule.IpProtocol ?? "-1");
+  const from = rule.FromPort as number | undefined;
+  const to = rule.ToPort as number | undefined;
+  const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
+  const source = rule.SourceSecurityGroupId;
+  const group = source && typeof source === "object" && typeof (source as { $ref?: unknown }).$ref === "string"
+    ? String((source as { $ref: string }).$ref).replace(/\.[A-Za-z]+$/, "")
+    : source;
+  const cidr =
+    (rule.CidrIp as string | undefined) ??
+    (rule.CidrIpv6 as string | undefined) ??
+    (group ? `sg:${String(group)}` : "?");
+  return `${proto}:${port}:${cidr}`;
+}
+
+/** The chant entity types every terraform `resource` and `data` block carries. */
+const TERRAFORM_RESOURCE = "Terraform::Resource";
+const TERRAFORM_DATA = "Terraform::Data";
+
+/**
+ * The Terraform type of a `resource` or `data` node: `aws_instance` for
+ * `aws_instance.web`, `data.aws_ami` for `data.aws_ami.ubuntu`. Undefined for
+ * any other node.
+ *
+ * This is the one reading of a terraform node's type. `chant search`'s `kind:`
+ * (#4366), its rows and `--explain` count, `--count-by kind` (#4360) and the
+ * effective-topology folds (#4362) all call it, so they cannot disagree.
+ *
+ * The terraform lexicon puts every resource on the IR as `Terraform::Resource`
+ * (and every data source as `Terraform::Data`) and carries the block's type
+ * label as `attrs.type` (#4366), which is read first. A node without one (an
+ * older producer, or a `chant graph --live` node built from state) falls back
+ * to the block's address (`aws_instance.web`, or `module.app.aws_instance.web`)
+ * in `attrs.address`, whose second-to-last segment is the type, and failing
+ * that to its id, whose last path segment is the address too. A data source
+ * keeps its `data.` prefix: `data.aws_ami` reads an AMI, it does not manage one.
+ */
+export function terraformType(n: IRNode | undefined): string | undefined {
+  if (!n || (n.kind !== TERRAFORM_RESOURCE && n.kind !== TERRAFORM_DATA)) return undefined;
+  const label = (n.attrs as Record<string, unknown> | undefined)?.["type"];
+  let type = typeof label === "string" && label.length > 0 ? label : undefined;
+  if (type === undefined) {
+    const parts = terraformAddress(n).split(".");
+    type = parts.length >= 2 ? parts[parts.length - 2] : undefined;
+  }
+  if (type === undefined) return undefined;
+  return n.kind === TERRAFORM_DATA ? `data.${type}` : type;
+}
+
+/**
+ * The provider resource type of a terraform `resource` node (`aws_instance`),
+ * or undefined for any other node, data sources included. See {@link terraformType}.
+ */
+export function terraformResourceType(n: IRNode | undefined): string | undefined {
+  return n?.kind === TERRAFORM_RESOURCE ? terraformType(n) : undefined;
+}
+
+function terraformAddress(n: IRNode): string {
+  const address = (n.attrs as Record<string, unknown> | undefined)?.["address"];
+  if (typeof address === "string" && address.length > 0) return address;
+  return n.id.slice(n.id.lastIndexOf("/") + 1).replace(/~\d+$/, "");
+}
+
+type Body = Record<string, unknown>;
+
+function bodyOf(n: IRNode): Body {
+  const body = (n.attrs as Record<string, unknown> | undefined)?.["body"];
+  return body && typeof body === "object" && !Array.isArray(body) ? (body as Body) : {};
+}
+
+/** A block-or-list attribute as a list: hcl2json renders nested blocks as arrays. */
+function list(value: unknown): unknown[] {
+  if (value == null) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
+/** `${aws_security_group.x.id}` -> `aws_security_group.x`; anything else unchanged. */
+function sourceRef(value: unknown): string {
+  const s = String(value);
+  const m = /^\$\{([A-Za-z0-9_.-]+?)(?:\.(?:id|arn|name))?\}$/.exec(s);
+  return m ? m[1] : s;
+}
+
+/**
+ * One terraform ingress rule, in any of its three spellings, normalized to the
+ * `proto:port:source` strings the CloudFormation fold produces. A rule with
+ * several CIDRs or sources yields one string per source, so each is queryable
+ * on its own.
+ */
+function terraformIngress(rule: Body, fields: {
+  proto: string;
+  cidrs: string[];
+  groups: string[];
+}): string[] {
+  const rawProto = String(rule[fields.proto] ?? "-1").toLowerCase();
+  const proto = rawProto === "all" ? "-1" : rawProto;
+  const from = rule["from_port"];
+  const to = rule["to_port"];
+  const port =
+    proto === "-1" || from == null
+      ? "all"
+      : String(from) === String(to ?? from)
+        ? `${from}`
+        : `${from}-${to}`;
+  const sources: string[] = [];
+  for (const f of fields.cidrs) for (const c of list(rule[f])) sources.push(String(c));
+  for (const f of fields.groups) for (const g of list(rule[f])) sources.push(`sg:${sourceRef(g)}`);
+  if (rule["self"] === true) sources.push("sg:self");
+  if (sources.length === 0) sources.push("?");
+  return sources.map((src) => `${proto}:${port}:${src}`);
+}

package/src/graph-ir.test.ts

@@ -6,6 +6,8 @@ import { LexiconOutput } from "./lexicon-output";
 import { resolveAttrRefs } from "./discovery/resolve";
 import { setProvenance } from "./provenance";
 import { INTRINSIC_MARKER } from "./intrinsic";
+import { applyDetail } from "./graph-detail";
+import { buildInterpolatedString, defaultInterpolationSerializer } from "./intrinsic-interpolation";
 
 function decl<T extends object>(base: T): Declarable & T {
   return { [DECLARABLE_MARKER]: true, ...base } as Declarable & T;
@@ -392,3 +394,164 @@ describe("applyLexiconOutputs (#3931)", () => {
     expect(applyLexiconOutputs(ir, [{ outputs: [] }])).toBe(ir);
   });
 });
+
+/**
+ * A `Sub`-tagged intrinsic shaped like the aws lexicon's `SubIntrinsic`: the
+ * template parts and live values it was written with, serialized the same way.
+ */
+function sub(parts: TemplateStringsArray, ...values: unknown[]): object {
+  const serialize = defaultInterpolationSerializer((name, attr) => `\${${name}.${attr}}`, (r) => `\${${r}}`);
+  return {
+    [INTRINSIC_MARKER]: true,
+    values,
+    toJSON: () => ({ "Fn::Sub": buildInterpolatedString([...parts], values, serialize) }),
+  };
+}
+
+/** An attribute AttrRef held on its producer, as a typed lexicon's resources hold theirs, so `resolveAttrRefs` names it. */
+function attr(entity: Declarable, name: string): AttrRef {
+  const r = new AttrRef(entity, name);
+  (entity as unknown as Record<string, unknown>)[name] = r;
+  return r;
+}
+
+/** A two-argument `Sub`, as an intrinsic serializes it. */
+function subWithVars(template: string, vars: Record<string, unknown>): object {
+  return { [INTRINSIC_MARKER]: true, toJSON: () => ({ "Fn::Sub": [template, vars] }) };
+}
+
+describe("a reference inside a CloudFormation Sub (#4373)", () => {
+  function estate(policyResource: unknown, extra: Array<[string, Declarable]> = []) {
+    const assets = decl({ lexicon: "aws", entityType: "AWS::S3::Bucket" });
+    const secret = decl({ lexicon: "aws", entityType: "AWS::SecretsManager::Secret" });
+    const policy = decl({
+      lexicon: "aws",
+      entityType: "AWS::IAM::Policy",
+      props: { PolicyName: "web", PolicyDocument: { Statement: [{ Effect: "Allow", Resource: policyResource }] } },
+    });
+    const entities = new Map<string, Declarable>([["assets", assets], ["secret", secret], ["policy", policy], ...extra]);
+    resolveAttrRefs(entities);
+    return { ir: buildGraphIr(entities), assets, secret };
+  }
+
+  test("${Res.Attr} is an edge through the top-level attribute, and attrs keep the template", () => {
+    const assets = decl({ lexicon: "aws", entityType: "AWS::S3::Bucket" });
+    const policy = decl({
+      lexicon: "aws",
+      entityType: "AWS::IAM::Policy",
+      props: { PolicyDocument: { Statement: [{ Resource: sub`${attr(assets, "Arn")}/*` }] } },
+    });
+    const entities = new Map<string, Declarable>([["assets", assets], ["policy", policy]]);
+    resolveAttrRefs(entities);
+    const ir = buildGraphIr(entities);
+
+    expect(ir.edges).toEqual([{ from: "policy", to: "assets", kind: "ref", viaAttr: "PolicyDocument" }]);
+    const attrs = ir.nodes.find((n) => n.id === "policy")!.attrs;
+    expect(attrs.PolicyDocument).toEqual({ Statement: [{ Resource: { $sub: "${assets.Arn}/*" } }] });
+  });
+
+  test("the edge is on every detail tier that carries edges; T3 names the producer attribute", () => {
+    const assets = decl({ lexicon: "aws", entityType: "AWS::S3::Bucket" });
+    const secret = decl({ lexicon: "aws", entityType: "AWS::SecretsManager::Secret" });
+    const db = decl({
+      lexicon: "aws",
+      entityType: "AWS::RDS::DBInstance",
+      props: {
+        MasterUserPassword: sub`{{resolve:secretsmanager:${ref("secret")}}}`,
+        Policy: { Resource: sub`${attr(assets, "Arn")}/*` },
+      },
+    });
+    const entities = new Map<string, Declarable>([["assets", assets], ["secret", secret], ["db", db]]);
+    resolveAttrRefs(entities);
+    const ir = buildGraphIr(entities);
+
+    const t2 = applyDetail(ir, 2);
+    expect(t2.edges).toEqual([
+      { from: "db", to: "assets", kind: "ref", viaAttr: "Policy" },
+      { from: "db", to: "secret", kind: "ref", viaAttr: "MasterUserPassword" },
+    ]);
+    // A top-level Sub is a reference envelope, kept at T2 like a $ref.
+    expect(t2.nodes.find((n) => n.id === "db")!.attrs.MasterUserPassword).toEqual({
+      $sub: "{{resolve:secretsmanager:${secret}}}",
+    });
+    // T3: the producer attribute when the template names one; none for a bare ${Name}.
+    expect(applyDetail(ir, 3).edges).toEqual([
+      { from: "db", to: "assets", kind: "ref", viaAttr: "Policy", toAttr: "Arn" },
+      { from: "db", to: "secret", kind: "ref", viaAttr: "MasterUserPassword" },
+    ]);
+    // T1 keeps a composite-free graph's edges.
+    expect(applyDetail(ir, 1).edges.map((e) => `${e.from}->${e.to}`).sort()).toEqual(["db->assets", "db->secret"]);
+  });
+
+  test("${Res} written by name in the template text is an edge too", () => {
+    const { ir } = estate(sub`arn:aws:s3:::\${assets}/*`);
+    expect(ir.edges).toEqual([{ from: "policy", to: "assets", kind: "ref", viaAttr: "PolicyDocument" }]);
+  });
+
+  test("a Sub with only pseudo-parameters adds no edge", () => {
+    const { ir } = estate(sub`arn:aws:s3:::logs-\${AWS::Region}-\${AWS::AccountId}/*`);
+    expect(ir.edges).toEqual([]);
+    const statement = (ir.nodes.find((n) => n.id === "policy")!.attrs.PolicyDocument as { Statement: unknown[] }).Statement[0];
+    expect(statement).toEqual({ Effect: "Allow", Resource: { $sub: "arn:aws:s3:::logs-${AWS::Region}-${AWS::AccountId}/*" } });
+  });
+
+  test("${!Escaped} is literal text, not a reference", () => {
+    const { ir } = estate(sub`\${!assets}/*`);
+    expect(ir.edges).toEqual([]);
+  });
+
+  test("two-argument form: the variable map's references are edges, the names it binds are not", () => {
+    const { ir } = estate(
+      subWithVars("${Bucket}/${assets}/${Region}", {
+        Bucket: { "Fn::GetAtt": ["secret", "Arn"] },
+        Region: { Ref: "AWS::Region" },
+      }),
+    );
+    // `${assets}` is unbound, so a resource name; `${Bucket}` is the map's own.
+    expect(ir.edges).toEqual([
+      { from: "policy", to: "assets", kind: "ref", viaAttr: "PolicyDocument" },
+      { from: "policy", to: "secret", kind: "ref", viaAttr: "PolicyDocument" },
+    ]);
+    const statement = (ir.nodes.find((n) => n.id === "policy")!.attrs.PolicyDocument as { Statement: unknown[] }).Statement[0];
+    expect(statement).toMatchObject({
+      Resource: { $sub: "${Bucket}/${assets}/${Region}", $vars: { Bucket: { "Fn::GetAtt": ["secret", "Arn"] } } },
+    });
+  });
+
+  test("a Sub written as plain CloudFormation JSON, with live values in its map", () => {
+    const assets = decl({ lexicon: "aws", entityType: "AWS::S3::Bucket" });
+    const secret = decl({ lexicon: "aws", entityType: "AWS::SecretsManager::Secret" });
+    const policy = decl({
+      lexicon: "aws",
+      entityType: "AWS::IAM::Policy",
+      props: { Resource: { "Fn::Sub": ["${assets.Arn}/${Key}", { Key: attr(secret, "Id") }] } },
+    });
+    const entities = new Map<string, Declarable>([["assets", assets], ["secret", secret], ["policy", policy]]);
+    resolveAttrRefs(entities);
+    const ir = buildGraphIr(entities);
+    expect(ir.edges).toEqual([
+      { from: "policy", to: "assets", kind: "ref", viaAttr: "Resource" },
+      { from: "policy", to: "secret", kind: "ref", viaAttr: "Resource" },
+    ]);
+    expect(ir.nodes.find((n) => n.id === "policy")!.attrs.Resource).toEqual({
+      $sub: "${assets.Arn}/${Key}",
+      $vars: { Key: { $ref: "secret.Id" } },
+    });
+    expect(applyDetail(ir, 3).edges.find((e) => e.to === "assets")!.toAttr).toBe("Arn");
+  });
+
+  test("a Sub whose AttrRef has no logical name still yields the edge from its live value", () => {
+    const assets = decl({ lexicon: "aws", entityType: "AWS::S3::Bucket" });
+    const unnamed = new AttrRef(assets, "Arn"); // never resolved: toJSON() throws
+    const policy = decl({ lexicon: "aws", entityType: "AWS::IAM::Policy", props: { Resource: sub`${unnamed}/*` } });
+    const ir = buildGraphIr(new Map<string, Declarable>([["assets", assets], ["policy", policy]]));
+    expect(ir.edges).toEqual([{ from: "policy", to: "assets", kind: "ref", viaAttr: "Resource" }]);
+    expect(ir.nodes.find((n) => n.id === "policy")!.attrs.Resource).toEqual({ $intrinsic: true });
+  });
+
+  test("an intrinsic that is not a Sub stays opaque", () => {
+    const joinLike = { [INTRINSIC_MARKER]: true, values: [ref("assets")], toJSON: () => ({ "Fn::Join": ["", []] }) };
+    const { ir } = estate(joinLike);
+    expect(ir.edges).toEqual([]);
+  });
+});